FABRIC-3.10.8 K-9: remove a dead VM's physics node at KILL and reap

vm_physics_remove() retires the node (heat to the root) and frees it;
capsule_vm_kill() and capsule_vm_force_reap() call it, so WIREBIND/EJECT
kills and reaps now retire too (before, only the KILL word did). A dead
VM now leaves only its registry node (168 B). 3-ISA acceptance clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/starkernel/capsule/capsule_birth.c

@@ -45,6 +45,7 @@
 #include "vm.h"
 #include "platform_alloc.h"
 #include "starkernel/spinlock.h" /* FABRIC-3.10.8 MC-0b -- g_lock_registry */
+#include "starkernel/capsule_vm_physics.h" /* FABRIC-3.10.8 K-9 -- vm_physics_remove() */
 /* No LOG_LINE_MAX include-order constraint anymore: vm.h's own
  * LOG_LINE_MAX (persistent block-log, 64) and log.h's in-memory line
  * length (renamed LOG_MSG_LINE_MAX, 256) are distinct names, so include
@@ -454,6 +455,10 @@ void capsule_vm_force_reap(VMUuid vm_id) {
      * Hermes departure above, which returns its pending mail). */
     (void)stadium_release_quota(vm_id);
 
+    /* FABRIC-3.10.8 K-9: its fleet-physics node -- heat to the root, node
+     * freed. Before the entry goes DEAD: retirement walks the registry. */
+    vm_physics_remove(vm_id);
+
     capsule_parity_log_kill(vm_id, entry->name);
 
     console_puts("REAP: ");
@@ -642,6 +647,9 @@ int capsule_vm_kill(const char *name) {
     /* FABRIC-3.10.8 K-4: its Stadium quota slot is released. */
     (void)stadium_release_quota(vm_id);
 
+    /* FABRIC-3.10.8 K-9: its fleet-physics node, as in force_reap above. */
+    vm_physics_remove(vm_id);
+
     sk_spin_lock(&g_lock_registry);
     entry->vm_ptr = (void *)0;
     entry->state  = VM_STATE_DEAD;

src/starkernel/capsule/capsule_vm_physics.c

@@ -300,6 +300,25 @@ void vm_physics_retire(VMUuid vm_id)
     dying->physics.is_live             = 0;
 }
 
+void vm_physics_remove(VMUuid vm_id)
+{
+    vm_physics_node_t **link = &vm_physics_head;
+    vm_physics_node_t  *n;
+
+    if (vm_uuid_is_hera(vm_id)) return; /* the root is never removed */
+
+    vm_physics_retire(vm_id); /* its heat to the root first; no-op if already retired */
+
+    while ((n = *link) != (void *)0) {
+        if (vm_uuid_equal(n->vm_id, vm_id)) {
+            *link = n->next;
+            kfree(n);
+            return;
+        }
+        link = &n->next;
+    }
+}
+
 void vm_physics_touch(VMUuid vm_id)
 {
     vm_physics_node_t  *target   = vm_physics_find(vm_id);

src/starkernel/capsule/mama_forth_words.c

@@ -598,16 +598,13 @@ void mama_word_kill(VM *vm)
     for (i = 0; i < (uint32_t)u; i++) name_buf[i] = src[i];
     name_buf[u] = '\0';
 
-    /* Resolve vm_id and fan out its heat to survivors before the registry
-     * entry is torn down -- capsule_vm_kill() only takes a name and
-     * leaves no live entry to query afterward. Excludes Hera: her
-     * self-referential parent_vm_id makes vm_physics_retire() treat her
-     * as her own unreachable root and zero the fleet's entire heat sum,
-     * before capsule_vm_kill()'s own Hera guard below ever runs. */
+    /* The dying VM's heat goes to the root inside capsule_vm_kill()
+     * (vm_physics_remove(), FABRIC-3.10.8 K-9), for every caller; this
+     * word used to retire it here, so WIREBIND/EJECT kills never did. */
     {
         VMRegistryEntry entry;
         /* FABRIC-3.md §XXVIII, Stage 2 (2026-09-13): refuse here too, so the
-         * heat-fanout/active-VM cleanup below never runs against a VM
+         * active-VM cleanup below never runs against a VM
          * that's about to be refused anyway. FABRIC-3.8.md §3.5 (Stage D):
          * the rule itself now lives in one place, capsule_vm_kill_refusal(),
          * rather than a copy of capsule_vm_kill()'s old blanket
@@ -623,9 +620,6 @@ void mama_word_kill(VM *vm)
         }
         if (capsule_vm_find_by_name_nocase(name_buf, &entry) == 0 &&
             (entry.state == VM_STATE_LIVE || entry.state == VM_STATE_SWITCHED_OUT)) {
-            if (!vm_uuid_is_hera(entry.vm_id)) {
-                vm_physics_retire(entry.vm_id);
-            }
             /* FABRIC-2.md §F.10, real bug found and reported 2026-08-27,
              * fixed 2026-09-05: capsule_vm_kill() never touches
              * g_repl_active_vm -- killing the VM the console is currently